hiddev.c 23.8 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34
/*
 *  Copyright (c) 2001 Paul Stewart
 *  Copyright (c) 2001 Vojtech Pavlik
 *
 *  HID char devices, giving access to raw HID device events.
 *
 */

/*
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 * Should you need to contact me, the author, you can do so either by
 * e-mail - mail your message to Paul Stewart <stewart@wetlogic.net>
 */

#include <linux/poll.h>
#include <linux/slab.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/smp_lock.h>
#include <linux/input.h>
#include <linux/usb.h>
35
#include <linux/hid.h>
L
Linus Torvalds 已提交
36
#include <linux/hiddev.h>
37
#include <linux/compat.h>
38
#include "usbhid.h"
L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46

#ifdef CONFIG_USB_DYNAMIC_MINORS
#define HIDDEV_MINOR_BASE	0
#define HIDDEV_MINORS		256
#else
#define HIDDEV_MINOR_BASE	96
#define HIDDEV_MINORS		16
#endif
47
#define HIDDEV_BUFFER_SIZE	2048
L
Linus Torvalds 已提交
48 49 50 51

struct hiddev {
	int exist;
	int open;
52
	struct mutex existancelock;
L
Linus Torvalds 已提交
53 54
	wait_queue_head_t wait;
	struct hid_device *hid;
55
	struct list_head list;
56
	spinlock_t list_lock;
L
Linus Torvalds 已提交
57 58 59 60 61 62 63 64 65
};

struct hiddev_list {
	struct hiddev_usage_ref buffer[HIDDEV_BUFFER_SIZE];
	int head;
	int tail;
	unsigned flags;
	struct fasync_struct *fasync;
	struct hiddev *hiddev;
66
	struct list_head node;
67
	struct mutex thread_lock;
L
Linus Torvalds 已提交
68 69 70 71 72 73 74 75 76 77 78
};

/*
 * Find a report, given the report's type and ID.  The ID can be specified
 * indirectly by REPORT_ID_FIRST (which returns the first report of the given
 * type) or by (REPORT_ID_NEXT | old_id), which returns the next report of the
 * given type which follows old_id.
 */
static struct hid_report *
hiddev_lookup_report(struct hid_device *hid, struct hiddev_report_info *rinfo)
{
79 80
	unsigned int flags = rinfo->report_id & ~HID_REPORT_ID_MASK;
	unsigned int rid = rinfo->report_id & HID_REPORT_ID_MASK;
L
Linus Torvalds 已提交
81
	struct hid_report_enum *report_enum;
82
	struct hid_report *report;
L
Linus Torvalds 已提交
83 84 85
	struct list_head *list;

	if (rinfo->report_type < HID_REPORT_TYPE_MIN ||
86 87
	    rinfo->report_type > HID_REPORT_TYPE_MAX)
		return NULL;
L
Linus Torvalds 已提交
88 89 90 91 92 93 94 95 96

	report_enum = hid->report_enum +
		(rinfo->report_type - HID_REPORT_TYPE_MIN);

	switch (flags) {
	case 0: /* Nothing to do -- report_id is already set correctly */
		break;

	case HID_REPORT_ID_FIRST:
97
		if (list_empty(&report_enum->report_list))
L
Linus Torvalds 已提交
98
			return NULL;
99 100 101 102

		list = report_enum->report_list.next;
		report = list_entry(list, struct hid_report, list);
		rinfo->report_id = report->id;
L
Linus Torvalds 已提交
103
		break;
104

L
Linus Torvalds 已提交
105
	case HID_REPORT_ID_NEXT:
106 107
		report = report_enum->report_id_hash[rid];
		if (!report)
L
Linus Torvalds 已提交
108
			return NULL;
109 110

		list = report->list.next;
L
Linus Torvalds 已提交
111 112
		if (list == &report_enum->report_list)
			return NULL;
113 114 115

		report = list_entry(list, struct hid_report, list);
		rinfo->report_id = report->id;
L
Linus Torvalds 已提交
116
		break;
117

L
Linus Torvalds 已提交
118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137
	default:
		return NULL;
	}

	return report_enum->report_id_hash[rinfo->report_id];
}

/*
 * Perform an exhaustive search of the report table for a usage, given its
 * type and usage id.
 */
static struct hid_field *
hiddev_lookup_usage(struct hid_device *hid, struct hiddev_usage_ref *uref)
{
	int i, j;
	struct hid_report *report;
	struct hid_report_enum *report_enum;
	struct hid_field *field;

	if (uref->report_type < HID_REPORT_TYPE_MIN ||
138 139
	    uref->report_type > HID_REPORT_TYPE_MAX)
		return NULL;
L
Linus Torvalds 已提交
140 141 142 143

	report_enum = hid->report_enum +
		(uref->report_type - HID_REPORT_TYPE_MIN);

144
	list_for_each_entry(report, &report_enum->report_list, list) {
L
Linus Torvalds 已提交
145 146 147 148 149 150 151 152 153 154 155
		for (i = 0; i < report->maxfield; i++) {
			field = report->field[i];
			for (j = 0; j < field->maxusage; j++) {
				if (field->usage[j].hid == uref->usage_code) {
					uref->report_id = report->id;
					uref->field_index = i;
					uref->usage_index = j;
					return field;
				}
			}
		}
156
	}
L
Linus Torvalds 已提交
157 158 159 160 161 162 163 164

	return NULL;
}

static void hiddev_send_event(struct hid_device *hid,
			      struct hiddev_usage_ref *uref)
{
	struct hiddev *hiddev = hid->hiddev;
165
	struct hiddev_list *list;
166
	unsigned long flags;
L
Linus Torvalds 已提交
167

168
	spin_lock_irqsave(&hiddev->list_lock, flags);
169
	list_for_each_entry(list, &hiddev->list, node) {
L
Linus Torvalds 已提交
170 171 172
		if (uref->field_index != HID_FIELD_INDEX_NONE ||
		    (list->flags & HIDDEV_FLAG_REPORT) != 0) {
			list->buffer[list->head] = *uref;
173
			list->head = (list->head + 1) &
L
Linus Torvalds 已提交
174 175 176 177
				(HIDDEV_BUFFER_SIZE - 1);
			kill_fasync(&list->fasync, SIGIO, POLL_IN);
		}
	}
178
	spin_unlock_irqrestore(&hiddev->list_lock, flags);
L
Linus Torvalds 已提交
179 180 181 182 183 184 185 186 187

	wake_up_interruptible(&hiddev->wait);
}

/*
 * This is where hid.c calls into hiddev to pass an event that occurred over
 * the interrupt pipe
 */
void hiddev_hid_event(struct hid_device *hid, struct hid_field *field,
188
		      struct hid_usage *usage, __s32 value)
L
Linus Torvalds 已提交
189 190 191 192
{
	unsigned type = field->report_type;
	struct hiddev_usage_ref uref;

193
	uref.report_type =
L
Linus Torvalds 已提交
194
	  (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
195
	  ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
196
	   ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
L
Linus Torvalds 已提交
197 198 199 200 201 202 203 204
	uref.report_id = field->report->id;
	uref.field_index = field->index;
	uref.usage_index = (usage - field->usage);
	uref.usage_code = usage->hid;
	uref.value = value;

	hiddev_send_event(hid, &uref);
}
J
Jiri Kosina 已提交
205
EXPORT_SYMBOL_GPL(hiddev_hid_event);
L
Linus Torvalds 已提交
206 207 208 209 210 211 212

void hiddev_report_event(struct hid_device *hid, struct hid_report *report)
{
	unsigned type = report->type;
	struct hiddev_usage_ref uref;

	memset(&uref, 0, sizeof(uref));
213
	uref.report_type =
L
Linus Torvalds 已提交
214
	  (type == HID_INPUT_REPORT) ? HID_REPORT_TYPE_INPUT :
215
	  ((type == HID_OUTPUT_REPORT) ? HID_REPORT_TYPE_OUTPUT :
216
	   ((type == HID_FEATURE_REPORT) ? HID_REPORT_TYPE_FEATURE : 0));
L
Linus Torvalds 已提交
217 218 219 220 221
	uref.report_id = report->id;
	uref.field_index = HID_FIELD_INDEX_NONE;

	hiddev_send_event(hid, &uref);
}
222

L
Linus Torvalds 已提交
223 224 225 226 227 228
/*
 * fasync file op
 */
static int hiddev_fasync(int fd, struct file *file, int on)
{
	struct hiddev_list *list = file->private_data;
229

230
	return fasync_helper(fd, file, on, &list->fasync);
L
Linus Torvalds 已提交
231 232 233 234 235 236 237 238 239
}


/*
 * release file op
 */
static int hiddev_release(struct inode * inode, struct file * file)
{
	struct hiddev_list *list = file->private_data;
240
	unsigned long flags;
L
Linus Torvalds 已提交
241

242
	spin_lock_irqsave(&list->hiddev->list_lock, flags);
243
	list_del(&list->node);
244
	spin_unlock_irqrestore(&list->hiddev->list_lock, flags);
L
Linus Torvalds 已提交
245 246

	if (!--list->hiddev->open) {
247
		if (list->hiddev->exist) {
J
Jiri Kosina 已提交
248
			usbhid_close(list->hiddev->hid);
249 250
			usbhid_put_power(list->hiddev->hid);
		} else {
L
Linus Torvalds 已提交
251
			kfree(list->hiddev);
252
		}
L
Linus Torvalds 已提交
253 254 255 256 257 258 259 260 261 262
	}

	kfree(list);

	return 0;
}

/*
 * open file op
 */
263 264
static int hiddev_open(struct inode *inode, struct file *file)
{
L
Linus Torvalds 已提交
265
	struct hiddev_list *list;
266
	struct usb_interface *intf;
267
	struct hid_device *hid;
268 269
	struct hiddev *hiddev;
	int res;
L
Linus Torvalds 已提交
270

271
	intf = usbhid_find_interface(iminor(inode));
272
	if (!intf)
L
Linus Torvalds 已提交
273
		return -ENODEV;
274 275
	hid = usb_get_intfdata(intf);
	hiddev = hid->hiddev;
L
Linus Torvalds 已提交
276

O
Oliver Neukum 已提交
277
	if (!(list = kzalloc(sizeof(struct hiddev_list), GFP_KERNEL)))
L
Linus Torvalds 已提交
278
		return -ENOMEM;
279
	mutex_init(&list->thread_lock);
280
	list->hiddev = hiddev;
L
Linus Torvalds 已提交
281 282
	file->private_data = list;

283 284 285 286 287 288
	/*
	 * no need for locking because the USB major number
	 * is shared which usbcore guards against disconnect
	 */
	if (list->hiddev->exist) {
		if (!list->hiddev->open++) {
289
			res = usbhid_open(hiddev->hid);
290 291 292 293 294 295 296 297 298 299 300
			if (res < 0) {
				res = -EIO;
				goto bail;
			}
		}
	} else {
		res = -ENODEV;
		goto bail;
	}

	spin_lock_irq(&list->hiddev->list_lock);
301
	list_add_tail(&list->node, &hiddev->list);
302
	spin_unlock_irq(&list->hiddev->list_lock);
L
Linus Torvalds 已提交
303

304 305
	if (!list->hiddev->open++)
		if (list->hiddev->exist) {
306
			struct hid_device *hid = hiddev->hid;
307 308 309 310 311 312 313
			res = usbhid_get_power(hid);
			if (res < 0) {
				res = -EIO;
				goto bail;
			}
			usbhid_open(hid);
		}
L
Linus Torvalds 已提交
314
	return 0;
315 316
bail:
	file->private_data = NULL;
317
	kfree(list);
318
	return res;
L
Linus Torvalds 已提交
319 320 321 322 323 324 325 326 327 328 329 330 331 332 333
}

/*
 * "write" file op
 */
static ssize_t hiddev_write(struct file * file, const char __user * buffer, size_t count, loff_t *ppos)
{
	return -EINVAL;
}

/*
 * "read" file op
 */
static ssize_t hiddev_read(struct file * file, char __user * buffer, size_t count, loff_t *ppos)
{
334
	DEFINE_WAIT(wait);
L
Linus Torvalds 已提交
335 336
	struct hiddev_list *list = file->private_data;
	int event_size;
337
	int retval;
L
Linus Torvalds 已提交
338 339 340 341 342 343 344

	event_size = ((list->flags & HIDDEV_FLAG_UREF) != 0) ?
		sizeof(struct hiddev_usage_ref) : sizeof(struct hiddev_event);

	if (count < event_size)
		return 0;

345 346 347 348 349
	/* lock against other threads */
	retval = mutex_lock_interruptible(&list->thread_lock);
	if (retval)
		return -ERESTARTSYS;

L
Linus Torvalds 已提交
350 351
	while (retval == 0) {
		if (list->head == list->tail) {
352
			prepare_to_wait(&list->hiddev->wait, &wait, TASK_INTERRUPTIBLE);
353

L
Linus Torvalds 已提交
354 355 356 357 358 359 360 361 362 363 364 365 366
			while (list->head == list->tail) {
				if (file->f_flags & O_NONBLOCK) {
					retval = -EAGAIN;
					break;
				}
				if (signal_pending(current)) {
					retval = -ERESTARTSYS;
					break;
				}
				if (!list->hiddev->exist) {
					retval = -EIO;
					break;
				}
367

368 369
				/* let O_NONBLOCK tasks run */
				mutex_unlock(&list->thread_lock);
L
Linus Torvalds 已提交
370
				schedule();
371 372
				if (mutex_lock_interruptible(&list->thread_lock))
					return -EINTR;
M
Micon, David 已提交
373
				set_current_state(TASK_INTERRUPTIBLE);
L
Linus Torvalds 已提交
374
			}
375
			finish_wait(&list->hiddev->wait, &wait);
L
Linus Torvalds 已提交
376 377 378

		}

379 380
		if (retval) {
			mutex_unlock(&list->thread_lock);
L
Linus Torvalds 已提交
381
			return retval;
382
		}
L
Linus Torvalds 已提交
383 384


385
		while (list->head != list->tail &&
L
Linus Torvalds 已提交
386 387
		       retval + event_size <= count) {
			if ((list->flags & HIDDEV_FLAG_UREF) == 0) {
388
				if (list->buffer[list->tail].field_index != HID_FIELD_INDEX_NONE) {
L
Linus Torvalds 已提交
389
					struct hiddev_event event;
390

L
Linus Torvalds 已提交
391 392
					event.hid = list->buffer[list->tail].usage_code;
					event.value = list->buffer[list->tail].value;
393 394
					if (copy_to_user(buffer + retval, &event, sizeof(struct hiddev_event))) {
						mutex_unlock(&list->thread_lock);
L
Linus Torvalds 已提交
395
						return -EFAULT;
396
					}
L
Linus Torvalds 已提交
397 398 399 400 401
					retval += sizeof(struct hiddev_event);
				}
			} else {
				if (list->buffer[list->tail].field_index != HID_FIELD_INDEX_NONE ||
				    (list->flags & HIDDEV_FLAG_REPORT) != 0) {
402 403 404

					if (copy_to_user(buffer + retval, list->buffer + list->tail, sizeof(struct hiddev_usage_ref))) {
						mutex_unlock(&list->thread_lock);
L
Linus Torvalds 已提交
405
						return -EFAULT;
406
					}
L
Linus Torvalds 已提交
407 408 409 410 411 412 413
					retval += sizeof(struct hiddev_usage_ref);
				}
			}
			list->tail = (list->tail + 1) & (HIDDEV_BUFFER_SIZE - 1);
		}

	}
414
	mutex_unlock(&list->thread_lock);
L
Linus Torvalds 已提交
415 416 417 418 419 420 421 422 423 424 425

	return retval;
}

/*
 * "poll" file op
 * No kernel lock - fine
 */
static unsigned int hiddev_poll(struct file *file, poll_table *wait)
{
	struct hiddev_list *list = file->private_data;
426

L
Linus Torvalds 已提交
427 428 429 430 431 432 433 434 435 436 437
	poll_wait(file, &list->hiddev->wait, wait);
	if (list->head != list->tail)
		return POLLIN | POLLRDNORM;
	if (!list->hiddev->exist)
		return POLLERR | POLLHUP;
	return 0;
}

/*
 * "ioctl" file op
 */
438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479
static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, void __user *user_arg)
{
	struct hid_device *hid = hiddev->hid;
	struct hiddev_report_info rinfo;
	struct hiddev_usage_ref_multi *uref_multi = NULL;
	struct hiddev_usage_ref *uref;
	struct hid_report *report;
	struct hid_field *field;
	int i;

	uref_multi = kmalloc(sizeof(struct hiddev_usage_ref_multi), GFP_KERNEL);
	if (!uref_multi)
		return -ENOMEM;
	uref = &uref_multi->uref;
	if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
		if (copy_from_user(uref_multi, user_arg,
				   sizeof(*uref_multi)))
			goto fault;
	} else {
		if (copy_from_user(uref, user_arg, sizeof(*uref)))
			goto fault;
	}

	switch (cmd) {
	case HIDIOCGUCODE:
		rinfo.report_type = uref->report_type;
		rinfo.report_id = uref->report_id;
		if ((report = hiddev_lookup_report(hid, &rinfo)) == NULL)
			goto inval;

		if (uref->field_index >= report->maxfield)
			goto inval;

		field = report->field[uref->field_index];
		if (uref->usage_index >= field->maxusage)
			goto inval;

		uref->usage_code = field->usage[uref->usage_index].hid;

		if (copy_to_user(user_arg, uref, sizeof(*uref)))
			goto fault;

J
Jiri Slaby 已提交
480
		goto goodreturn;
481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526

	default:
		if (cmd != HIDIOCGUSAGE &&
		    cmd != HIDIOCGUSAGES &&
		    uref->report_type == HID_REPORT_TYPE_INPUT)
			goto inval;

		if (uref->report_id == HID_REPORT_ID_UNKNOWN) {
			field = hiddev_lookup_usage(hid, uref);
			if (field == NULL)
				goto inval;
		} else {
			rinfo.report_type = uref->report_type;
			rinfo.report_id = uref->report_id;
			if ((report = hiddev_lookup_report(hid, &rinfo)) == NULL)
				goto inval;

			if (uref->field_index >= report->maxfield)
				goto inval;

			field = report->field[uref->field_index];

			if (cmd == HIDIOCGCOLLECTIONINDEX) {
				if (uref->usage_index >= field->maxusage)
					goto inval;
			} else if (uref->usage_index >= field->report_count)
				goto inval;

			else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
				 (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
				  uref->usage_index + uref_multi->num_values > field->report_count))
				goto inval;
			}

		switch (cmd) {
		case HIDIOCGUSAGE:
			uref->value = field->value[uref->usage_index];
			if (copy_to_user(user_arg, uref, sizeof(*uref)))
				goto fault;
			goto goodreturn;

		case HIDIOCSUSAGE:
			field->value[uref->usage_index] = uref->value;
			goto goodreturn;

		case HIDIOCGCOLLECTIONINDEX:
J
Jiri Slaby 已提交
527
			i = field->usage[uref->usage_index].collection_index;
528
			kfree(uref_multi);
J
Jiri Slaby 已提交
529
			return i;
530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584
		case HIDIOCGUSAGES:
			for (i = 0; i < uref_multi->num_values; i++)
				uref_multi->values[i] =
				    field->value[uref->usage_index + i];
			if (copy_to_user(user_arg, uref_multi,
					 sizeof(*uref_multi)))
				goto fault;
			goto goodreturn;
		case HIDIOCSUSAGES:
			for (i = 0; i < uref_multi->num_values; i++)
				field->value[uref->usage_index + i] =
				    uref_multi->values[i];
			goto goodreturn;
		}

goodreturn:
		kfree(uref_multi);
		return 0;
fault:
		kfree(uref_multi);
		return -EFAULT;
inval:
		kfree(uref_multi);
		return -EINVAL;
	}
}

static noinline int hiddev_ioctl_string(struct hiddev *hiddev, unsigned int cmd, void __user *user_arg)
{
	struct hid_device *hid = hiddev->hid;
	struct usb_device *dev = hid_to_usb_dev(hid);
	int idx, len;
	char *buf;

	if (get_user(idx, (int __user *)user_arg))
		return -EFAULT;

	if ((buf = kmalloc(HID_STRING_SIZE, GFP_KERNEL)) == NULL)
		return -ENOMEM;

	if ((len = usb_string(dev, idx, buf, HID_STRING_SIZE-1)) < 0) {
		kfree(buf);
		return -EINVAL;
	}

	if (copy_to_user(user_arg+sizeof(int), buf, len+1)) {
		kfree(buf);
		return -EFAULT;
	}

	kfree(buf);

	return len;
}

A
Alan Cox 已提交
585
static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
L
Linus Torvalds 已提交
586 587 588
{
	struct hiddev_list *list = file->private_data;
	struct hiddev *hiddev = list->hiddev;
589
	struct hid_device *hid;
590
	struct usb_device *dev;
L
Linus Torvalds 已提交
591 592 593 594 595 596
	struct hiddev_collection_info cinfo;
	struct hiddev_report_info rinfo;
	struct hiddev_field_info finfo;
	struct hiddev_devinfo dinfo;
	struct hid_report *report;
	struct hid_field *field;
597
	struct usbhid_device *usbhid;
L
Linus Torvalds 已提交
598
	void __user *user_arg = (void __user *)arg;
599
	int i, r;
600

A
Alan Cox 已提交
601
	/* Called without BKL by compat methods so no BKL taken */
L
Linus Torvalds 已提交
602

A
Alan Cox 已提交
603
	/* FIXME: Who or what stop this racing with a disconnect ?? */
604
	if (!hiddev->exist)
L
Linus Torvalds 已提交
605 606 607 608 609 610 611 612
		return -EIO;

	switch (cmd) {

	case HIDIOCGVERSION:
		return put_user(HID_VERSION, (int __user *)arg);

	case HIDIOCAPPLICATION:
613 614 615 616 617 618 619 620 621 622 623
		mutex_lock(&hiddev->existancelock);
		if (!hiddev->exist) {
			r = -ENODEV;
			goto ret_unlock;
		}

		hid = hiddev->hid;
		if (arg < 0 || arg >= hid->maxapplication) {
			r = -EINVAL;
			goto ret_unlock;
		}
L
Linus Torvalds 已提交
624 625

		for (i = 0; i < hid->maxcollection; i++)
626
			if (hid->collection[i].type ==
L
Linus Torvalds 已提交
627 628
			    HID_COLLECTION_APPLICATION && arg-- == 0)
				break;
629

L
Linus Torvalds 已提交
630
		if (i == hid->maxcollection)
631 632 633 634
			r = -EINVAL;
		else
			r = hid->collection[i].usage;
		goto ret_unlock;
L
Linus Torvalds 已提交
635 636

	case HIDIOCGDEVINFO:
637 638 639 640 641 642 643 644 645 646
		mutex_lock(&hiddev->existancelock);
		if (!hiddev->exist) {
			r = -ENODEV;
			goto ret_unlock;
		}

		hid = hiddev->hid;
		dev = hid_to_usb_dev(hid);
		usbhid = hid->driver_data;

L
Linus Torvalds 已提交
647 648 649
		dinfo.bustype = BUS_USB;
		dinfo.busnum = dev->bus->busnum;
		dinfo.devnum = dev->devnum;
J
Jiri Kosina 已提交
650
		dinfo.ifnum = usbhid->ifnum;
L
Linus Torvalds 已提交
651 652 653 654
		dinfo.vendor = le16_to_cpu(dev->descriptor.idVendor);
		dinfo.product = le16_to_cpu(dev->descriptor.idProduct);
		dinfo.version = le16_to_cpu(dev->descriptor.bcdDevice);
		dinfo.num_applications = hid->maxapplication;
655 656
		mutex_unlock(&hiddev->existancelock);

L
Linus Torvalds 已提交
657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684
		if (copy_to_user(user_arg, &dinfo, sizeof(dinfo)))
			return -EFAULT;

		return 0;

	case HIDIOCGFLAG:
		if (put_user(list->flags, (int __user *)arg))
			return -EFAULT;

		return 0;

	case HIDIOCSFLAG:
		{
			int newflags;
			if (get_user(newflags, (int __user *)arg))
				return -EFAULT;

			if ((newflags & ~HIDDEV_FLAGS) != 0 ||
			    ((newflags & HIDDEV_FLAG_REPORT) != 0 &&
			     (newflags & HIDDEV_FLAG_UREF) == 0))
				return -EINVAL;

			list->flags = newflags;

			return 0;
		}

	case HIDIOCGSTRING:
685
		mutex_lock(&hiddev->existancelock);
686
		if (hiddev->exist)
687 688 689
			r = hiddev_ioctl_string(hiddev, cmd, user_arg);
		else
			r = -ENODEV;
690
ret_unlock:
691 692
		mutex_unlock(&hiddev->existancelock);
		return r;
L
Linus Torvalds 已提交
693 694

	case HIDIOCINITREPORT:
695 696 697 698 699
		mutex_lock(&hiddev->existancelock);
		if (!hiddev->exist) {
			mutex_unlock(&hiddev->existancelock);
			return -ENODEV;
		}
700
		hid = hiddev->hid;
J
Jiri Kosina 已提交
701
		usbhid_init_reports(hid);
702
		mutex_unlock(&hiddev->existancelock);
L
Linus Torvalds 已提交
703 704 705 706 707 708 709 710 711 712

		return 0;

	case HIDIOCGREPORT:
		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo)))
			return -EFAULT;

		if (rinfo.report_type == HID_REPORT_TYPE_OUTPUT)
			return -EINVAL;

713
		mutex_lock(&hiddev->existancelock);
714 715 716 717 718 719 720 721 722 723
		if (!hiddev->exist) {
			r = -ENODEV;
			goto ret_unlock;
		}

		hid = hiddev->hid;
		report = hiddev_lookup_report(hid, &rinfo);
		if (report == NULL) {
			r = -EINVAL;
			goto ret_unlock;
724
		}
725 726 727

		usbhid_submit_report(hid, report, USB_DIR_IN);
		usbhid_wait_io(hid);
728
		mutex_unlock(&hiddev->existancelock);
L
Linus Torvalds 已提交
729 730 731 732 733 734 735 736 737 738

		return 0;

	case HIDIOCSREPORT:
		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo)))
			return -EFAULT;

		if (rinfo.report_type == HID_REPORT_TYPE_INPUT)
			return -EINVAL;

739
		mutex_lock(&hiddev->existancelock);
740 741 742 743 744 745 746 747 748 749
		if (!hiddev->exist) {
			r = -ENODEV;
			goto ret_unlock;
		}

		hid = hiddev->hid;
		report = hiddev_lookup_report(hid, &rinfo);
		if (report == NULL) {
			r = -EINVAL;
			goto ret_unlock;
750
		}
751 752 753

		usbhid_submit_report(hid, report, USB_DIR_OUT);
		usbhid_wait_io(hid);
754
		mutex_unlock(&hiddev->existancelock);
L
Linus Torvalds 已提交
755 756 757 758 759 760 761

		return 0;

	case HIDIOCGREPORTINFO:
		if (copy_from_user(&rinfo, user_arg, sizeof(rinfo)))
			return -EFAULT;

762 763 764 765 766 767 768 769 770 771 772 773
		mutex_lock(&hiddev->existancelock);
		if (!hiddev->exist) {
			r = -ENODEV;
			goto ret_unlock;
		}

		hid = hiddev->hid;
		report = hiddev_lookup_report(hid, &rinfo);
		if (report == NULL) {
			r = -EINVAL;
			goto ret_unlock;
		}
L
Linus Torvalds 已提交
774 775

		rinfo.num_fields = report->maxfield;
776
		mutex_unlock(&hiddev->existancelock);
L
Linus Torvalds 已提交
777 778 779 780 781 782 783 784 785 786 787

		if (copy_to_user(user_arg, &rinfo, sizeof(rinfo)))
			return -EFAULT;

		return 0;

	case HIDIOCGFIELDINFO:
		if (copy_from_user(&finfo, user_arg, sizeof(finfo)))
			return -EFAULT;
		rinfo.report_type = finfo.report_type;
		rinfo.report_id = finfo.report_id;
788 789 790 791 792
		mutex_lock(&hiddev->existancelock);
		if (!hiddev->exist) {
			r = -ENODEV;
			goto ret_unlock;
		}
L
Linus Torvalds 已提交
793

794 795 796 797 798 799 800 801 802 803 804
		hid = hiddev->hid;
		report = hiddev_lookup_report(hid, &rinfo);
		if (report == NULL) {
			r = -EINVAL;
			goto ret_unlock;
		}

		if (finfo.field_index >= report->maxfield) {
			r = -EINVAL;
			goto ret_unlock;
		}
L
Linus Torvalds 已提交
805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821

		field = report->field[finfo.field_index];
		memset(&finfo, 0, sizeof(finfo));
		finfo.report_type = rinfo.report_type;
		finfo.report_id = rinfo.report_id;
		finfo.field_index = field->report_count - 1;
		finfo.maxusage = field->maxusage;
		finfo.flags = field->flags;
		finfo.physical = field->physical;
		finfo.logical = field->logical;
		finfo.application = field->application;
		finfo.logical_minimum = field->logical_minimum;
		finfo.logical_maximum = field->logical_maximum;
		finfo.physical_minimum = field->physical_minimum;
		finfo.physical_maximum = field->physical_maximum;
		finfo.unit_exponent = field->unit_exponent;
		finfo.unit = field->unit;
822
		mutex_unlock(&hiddev->existancelock);
L
Linus Torvalds 已提交
823 824 825 826 827 828 829

		if (copy_to_user(user_arg, &finfo, sizeof(finfo)))
			return -EFAULT;

		return 0;

	case HIDIOCGUCODE:
830
		/* fall through */
L
Linus Torvalds 已提交
831 832 833 834 835
	case HIDIOCGUSAGE:
	case HIDIOCSUSAGE:
	case HIDIOCGUSAGES:
	case HIDIOCSUSAGES:
	case HIDIOCGCOLLECTIONINDEX:
836 837 838 839 840 841 842
		mutex_lock(&hiddev->existancelock);
		if (hiddev->exist)
			r = hiddev_ioctl_usage(hiddev, cmd, user_arg);
		else
			r = -ENODEV;
		mutex_unlock(&hiddev->existancelock);
		return r;
L
Linus Torvalds 已提交
843 844 845 846 847

	case HIDIOCGCOLLECTIONINFO:
		if (copy_from_user(&cinfo, user_arg, sizeof(cinfo)))
			return -EFAULT;

848 849 850 851 852 853 854 855 856 857 858
		mutex_lock(&hiddev->existancelock);
		if (!hiddev->exist) {
			r = -ENODEV;
			goto ret_unlock;
		}

		hid = hiddev->hid;
		if (cinfo.index >= hid->maxcollection) {
			r = -EINVAL;
			goto ret_unlock;
		}
L
Linus Torvalds 已提交
859 860 861 862

		cinfo.type = hid->collection[cinfo.index].type;
		cinfo.usage = hid->collection[cinfo.index].usage;
		cinfo.level = hid->collection[cinfo.index].level;
863
		mutex_lock(&hiddev->existancelock);
L
Linus Torvalds 已提交
864 865 866 867 868 869 870 871 872 873 874 875

		if (copy_to_user(user_arg, &cinfo, sizeof(cinfo)))
			return -EFAULT;
		return 0;

	default:

		if (_IOC_TYPE(cmd) != 'H' || _IOC_DIR(cmd) != _IOC_READ)
			return -EINVAL;

		if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGNAME(0))) {
			int len;
876 877 878 879 880 881 882 883 884 885 886 887 888

			mutex_lock(&hiddev->existancelock);
			if (!hiddev->exist) {
				r = -ENODEV;
				goto ret_unlock;
			}

			hid = hiddev->hid;
			if (!hid->name) {
				r = 0;
				goto ret_unlock;
			}

L
Linus Torvalds 已提交
889 890 891
			len = strlen(hid->name) + 1;
			if (len > _IOC_SIZE(cmd))
				 len = _IOC_SIZE(cmd);
892
			r = copy_to_user(user_arg, hid->name, len) ?
L
Linus Torvalds 已提交
893
				-EFAULT : len;
894
			goto ret_unlock;
L
Linus Torvalds 已提交
895 896 897 898
		}

		if (_IOC_NR(cmd) == _IOC_NR(HIDIOCGPHYS(0))) {
			int len;
899 900 901 902 903 904 905 906 907 908 909 910 911

			mutex_lock(&hiddev->existancelock);
			if (!hiddev->exist) {
				r = -ENODEV;
				goto ret_unlock;
			}

			hid = hiddev->hid;
			if (!hid->phys) {
				r = 0;
				goto ret_unlock;
			}

L
Linus Torvalds 已提交
912 913 914
			len = strlen(hid->phys) + 1;
			if (len > _IOC_SIZE(cmd))
				len = _IOC_SIZE(cmd);
915
			r = copy_to_user(user_arg, hid->phys, len) ?
L
Linus Torvalds 已提交
916
				-EFAULT : len;
917
			goto ret_unlock;
L
Linus Torvalds 已提交
918 919 920 921 922
		}
	}
	return -EINVAL;
}

923 924 925
#ifdef CONFIG_COMPAT
static long hiddev_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
926
	return hiddev_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
927 928 929
}
#endif

930
static const struct file_operations hiddev_fops = {
L
Linus Torvalds 已提交
931 932 933 934 935 936
	.owner =	THIS_MODULE,
	.read =		hiddev_read,
	.write =	hiddev_write,
	.poll =		hiddev_poll,
	.open =		hiddev_open,
	.release =	hiddev_release,
A
Alan Cox 已提交
937
	.unlocked_ioctl =	hiddev_ioctl,
L
Linus Torvalds 已提交
938
	.fasync =	hiddev_fasync,
939 940 941
#ifdef CONFIG_COMPAT
	.compat_ioctl	= hiddev_compat_ioctl,
#endif
942
	.llseek		= noop_llseek,
L
Linus Torvalds 已提交
943 944
};

945
static char *hiddev_devnode(struct device *dev, mode_t *mode)
946 947 948 949
{
	return kasprintf(GFP_KERNEL, "usb/%s", dev_name(dev));
}

L
Linus Torvalds 已提交
950
static struct usb_class_driver hiddev_class = {
951
	.name =		"hiddev%d",
952
	.devnode =	hiddev_devnode,
L
Linus Torvalds 已提交
953
	.fops =		&hiddev_fops,
954
	.minor_base =	HIDDEV_MINOR_BASE,
L
Linus Torvalds 已提交
955 956 957 958 959
};

/*
 * This is where hid.c calls us to connect a hid device to the hiddev driver
 */
J
Jiri Slaby 已提交
960
int hiddev_connect(struct hid_device *hid, unsigned int force)
L
Linus Torvalds 已提交
961 962
{
	struct hiddev *hiddev;
J
Jiri Kosina 已提交
963
	struct usbhid_device *usbhid = hid->driver_data;
L
Linus Torvalds 已提交
964 965
	int retval;

J
Jiri Slaby 已提交
966 967 968 969 970 971 972
	if (!force) {
		unsigned int i;
		for (i = 0; i < hid->maxcollection; i++)
			if (hid->collection[i].type ==
			    HID_COLLECTION_APPLICATION &&
			    !IS_INPUT_APPLICATION(hid->collection[i].usage))
				break;
L
Linus Torvalds 已提交
973

J
Jiri Slaby 已提交
974 975 976
		if (i == hid->maxcollection)
			return -1;
	}
L
Linus Torvalds 已提交
977

O
Oliver Neukum 已提交
978
	if (!(hiddev = kzalloc(sizeof(struct hiddev), GFP_KERNEL)))
L
Linus Torvalds 已提交
979 980 981
		return -1;

	init_waitqueue_head(&hiddev->wait);
982
	INIT_LIST_HEAD(&hiddev->list);
983
	spin_lock_init(&hiddev->list_lock);
984
	mutex_init(&hiddev->existancelock);
985
	hid->hiddev = hiddev;
L
Linus Torvalds 已提交
986 987
	hiddev->hid = hid;
	hiddev->exist = 1;
988 989 990
	retval = usb_register_dev(usbhid->intf, &hiddev_class);
	if (retval) {
		err_hid("Not able to get a minor for this device.");
991
		hid->hiddev = NULL;
992 993 994
		kfree(hiddev);
		return -1;
	}
L
Linus Torvalds 已提交
995 996 997 998 999 1000 1001 1002 1003 1004 1005
	return 0;
}

/*
 * This is where hid.c calls us to disconnect a hiddev device from the
 * corresponding hid device (usually because the usb device has disconnected)
 */
static struct usb_class_driver hiddev_class;
void hiddev_disconnect(struct hid_device *hid)
{
	struct hiddev *hiddev = hid->hiddev;
J
Jiri Kosina 已提交
1006
	struct usbhid_device *usbhid = hid->driver_data;
L
Linus Torvalds 已提交
1007

1008
	mutex_lock(&hiddev->existancelock);
L
Linus Torvalds 已提交
1009
	hiddev->exist = 0;
1010
	mutex_unlock(&hiddev->existancelock);
L
Linus Torvalds 已提交
1011

J
Jiri Kosina 已提交
1012
	usb_deregister_dev(usbhid->intf, &hiddev_class);
L
Linus Torvalds 已提交
1013 1014

	if (hiddev->open) {
J
Jiri Kosina 已提交
1015
		usbhid_close(hiddev->hid);
L
Linus Torvalds 已提交
1016 1017 1018 1019 1020
		wake_up_interruptible(&hiddev->wait);
	} else {
		kfree(hiddev);
	}
}